import jwt from "jsonwebtoken";
app.post("/patchwork/mint", requireUser, (req, res) => {
// Compose the subject from server session state, never from the request body.
const subject = `${req.user.id}:${req.session.workspaceId}`;
const token = jwt.sign(
{
iss: process.env.PATCHWORK_API_KEY_ID, // key_… — the public id
aud: ["patchwork", "your-api"],
sub: subject,
conn: process.env.PATCHWORK_CONNECTION_ID,
},
process.env.PATCHWORK_PRIVATE_KEY,
{ algorithm: "RS256", expiresIn: 120, keyid: "your-app-2026-01" },
);
res.json({ token, expires_in: 120 });
});